Privacy Policy

1. Controller

The controller responsible for processing personal data on this website is:

VIA X Technology and Innovation UG (haftungsbeschränkt)
Lange Straße 93
90762 Fürth
Germany

Managing Director: Daniel Wurzberger

Phone: +49 (0)911 49529250
Email: info@viaxtechnology.com
Website: www.viaxtechnology.com

2. General Information on Data Processing

We process personal data exclusively in accordance with applicable data protection law, in particular the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG), and the applicable provisions on privacy in digital services.

Personal data is any information relating to an identified or identifiable natural person.

We process personal data only to the extent necessary to provide our website, to handle enquiries, to initiate or perform business relationships, to arrange appointments, or to provide other services you make use of, or where another legal basis applies.

Where processing is based on your consent, you may withdraw that consent at any time with effect for the future. The lawfulness of processing carried out based on the consent until its withdrawal remains unaffected.

3. Hosting and Provision of the Website

When you access our website, technically necessary information is processed in order to deliver the website to your device and to ensure the security and stability of our systems.

This may process in particular:

the IP address of the accessing device,
the date and time of access,
the URL or file accessed,
the amount of data transferred,
the HTTP status code,
the referrer URL,
browser type and version,
operating system,
hostname or other technical device information.

This processing serves in particular to technically provide the website, to detect and defend against attacks, to analyse errors, and to ensure system security.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, reliable and uninterrupted operation of our website and IT infrastructure.

Where we use external providers for hosting, they act within the necessary scope under a data processing agreement pursuant to Art. 28 GDPR, i.e. as our processors.

Server and security logs are stored only as long as necessary for the respective technical or security-related purpose. Longer storage only takes place where necessary to investigate specific security incidents, to assert or defend legal claims, or due to statutory obligations.

4. Cookies, Local Storage Technologies and Consent Management

Our website may use cookies and comparable technologies that store information on your device or read information already stored there.

Strictly necessary technologies are used only to the extent they are required to provide a digital service you have expressly requested, or for the secure technical operation of the website.

Where storing or accessing information on your device is not strictly necessary, this only takes place with your prior consent.

For technologies that require consent, access to your device is based on § 25(1) TDDDG (the German Telecommunications Digital Services Data Protection Act), and the associated processing of personal data is based on Art. 6(1)(a) GDPR.

Strictly necessary access takes place under the statutory conditions of § 25(2) TDDDG. The subsequent processing of personal data is then based, depending on the specific purpose, in particular on Art. 6(1)(b), (c) or (f) GDPR.

We use a consent management system that lets you grant, decline, and later change or withdraw your consent.

The information required to store your privacy decision may be stored so that your choice is respected and so we can document compliance with our statutory record-keeping obligations.

You can change or withdraw a consent you have already given at any time, with effect for the future, via the cookie or privacy settings available on our website.

5. Contact by Email, Phone or Contact Form

If you contact us by email, by phone, or via a contact form provided on the website, we process the data you provide to handle your enquiry.

This may include in particular:

name,
company,
role,
email address,
phone number,
the content of your message,
details of a project or service need,
other information you voluntarily provide.

Where your enquiry serves to initiate or perform a contractual relationship, processing is based on Art. 6(1)(b) GDPR.

For other business or general enquiries, processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in handling enquiries and communicating with prospective clients, customers, partners and other business contacts.

Where processing in an individual case is based on consent, the legal basis is Art. 6(1)(a) GDPR.

We generally store enquiries only as long as necessary to handle them. Where a business or contractual relationship results from this, the data required for it may continue to be processed in accordance with the statutory and contractual retention periods applicable to that relationship.

6. Appointment Scheduling via Microsoft Bookings

On our website we offer the option to schedule appointments and non-binding initial calls online.

We use Microsoft Bookings for this purpose, a service within Microsoft 365.

The controller for the processing of personal data carried out in connection with scheduling an appointment is VIA X Technology and Innovation UG (haftungsbeschränkt).

We use Microsoft Bookings to organise, conduct and follow up on the appointments you request.

Depending on the area of our website, different types of appointments may be offered, for example:

discovery calls,
initial consultations on advisory services,
discussions on software and development projects,
discussions on IT projects or integration services,
discussions on freelancer needs,
recruiting and hiring conversations,
other initial and consultation calls.

The selected booking type may form part of the name and subject of the scheduled appointment and the associated appointment and Teams invitation.

6.1 Data Processed

When booking an appointment, we may process in particular the following personal data:

first and last name,
business email address,
phone number, where provided,
company,
role or position, where provided,
the selected appointment,
the selected appointment or service type,
time zone,
voluntary information about the reason for the call,
voluntarily submitted messages,
technical booking information,
information required to create and manage a Microsoft Teams meeting.

Please do not submit special categories of personal data within the meaning of Art. 9 GDPR in free-text fields unless expressly required for the appointment you wish to book.

6.2 Purposes of Processing

The data is processed in order to:

provide available appointment slots,
receive your appointment booking,
assign the desired contact person or service,
send appointment confirmations and reminders,
organisationally prepare the appointment,
provide a Microsoft Teams meeting where required,
conduct the scheduled appointment,
handle follow-up questions related to the booking.

6.3 Legal Basis

Where you schedule an appointment to initiate or perform a contractual relationship, processing is based on Art. 6(1)(b) GDPR.

Where scheduling the appointment cannot be directly attributed to initiating a contract, processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in the efficient organisation of business contacts, consultations and other enquiries.

6.4 Microsoft as a Service Provider

We use Microsoft 365 and Microsoft Bookings for the technical provision of appointment scheduling.

The provider within the European Economic Area is in particular:

Microsoft Ireland Operations Limited
One Microsoft Place
South County Business Park
Leopardstown
Dublin 18
Ireland

Booking data is processed within the Microsoft 365 infrastructure, in particular via Exchange.

For its commercial online services, Microsoft provides contractual data protection terms under the Microsoft Products and Services Data Protection Addendum.

For Microsoft 365, Microsoft also describes a so-called EU Data Boundary, within which customer data and personal data for the covered commercial online services are generally stored and processed.

In certain cases described by Microsoft, data may nonetheless be processed or transferred outside the European Union, the European Economic Area, or the EU Data Boundary.

Where personal data is transferred to a third country in this context, this takes place on the basis of the applicable statutory requirements and the safeguards provided by Microsoft for this purpose, in particular applicable adequacy decisions and/or appropriate contractual safeguards such as the European Commission’s Standard Contractual Clauses.

Further information is available from Microsoft in its privacy statement and the data protection terms applicable to Microsoft 365.

6.5 Technical Email Routing Within the VIA X Corporate Group

For the technical handling of appointment- and email-related communication, a centrally administered technical email infrastructure belonging to The VIA X Holding UG (haftungsbeschränkt) may be used.

VIA X Technology and Innovation UG (haftungsbeschränkt) remains the provider of the respective booked service, the customer’s point of contact, and the controller for the personal data processed in connection with the appointment booking.

The holding company’s technical infrastructure is used exclusively for the technical or organisational provision or forwarding of communication.

The holding company does not use the personal data transmitted in this way for its own purposes.

To the extent The VIA X Holding UG (haftungsbeschränkt) processes personal data on behalf of VIA X Technology in this context, it does so exclusively on instruction and on the basis of the data protection agreements required for this purpose – i.e. as a processor under Art. 28 GDPR or under an equivalent intercompany data protection agreement.

6.6 Embedding Microsoft Bookings on Our Website

Where Microsoft Bookings is embedded directly on our website, for example via an iframe, an embedded window, or a comparable external element, the external content is only loaded once you have given the relevant consent, to the extent consent is required for this.

When the external content loads, your IP address and technical browser and device information may in particular be transmitted to Microsoft.

The legal basis for access to your device requiring consent is § 25(1) TDDDG.

The legal basis for the processing of personal data associated with loading the external content is Art. 6(1)(a) GDPR.

You can withdraw your consent at any time, with effect for the future, via our cookie or privacy settings.

Where a button on our website merely links to an external Microsoft Bookings page and no Microsoft content or resources are loaded before you activate that link, data is only transmitted to Microsoft once you follow the link yourself.

6.7 Retention and Deletion for Appointment Bookings

Personal data required solely to organise and conduct an appointment arranged via Microsoft Bookings is generally deleted no later than 30 days after the appointment.

This includes in particular:

the Bookings appointment itself,
the automated appointment emails directly associated with the booking,
the personal booking information they contain.

For cancelled appointments, deletion likewise takes place within this 30-day deletion cycle following the cancellation or the completion of the organisational handling.

Where the appointment leads to a further business relationship, for example a quote, a project, a contract, a recruiting process, or other business cooperation, the information required for that purpose may continue to be processed independently of the Bookings appointment management, on the legal basis applicable to it.

The statutory, contractual or business retention periods applicable to that business data then apply.

The original Bookings appointment and the automated messages that serve solely to organise the appointment are removed independently of this, in accordance with the 30-day deletion concept described above.

Where personal data remains temporarily present in non-production systems due to technically necessary backup, recovery, security or logging procedures, it is not used for new purposes and is removed in line with the respective technical deletion cycles.

7. Conducting Online Meetings via Microsoft Teams

We may use Microsoft Teams for calls that take place online.

When using Microsoft Teams, the following data may in particular be processed:

name,
email address,
participant information,
the time and duration of the meeting,
technical connection and device data,
audio and video data, where you use a camera or microphone,
chat content and other information you share during the meeting.

This processing serves to conduct the call you requested.

Where the call serves to initiate or perform a contract, the legal basis is Art. 6(1)(b) GDPR.

In other business cases, processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in efficiently conducting location-independent business communication.

Calls are not recorded without the prior information, and where applicable consent, of the participants concerned that this requires.

8. Project, Freelancer and Candidate Enquiries

Where you provide us with personal data in connection with a project, freelance work, a placement, or a candidate introduction, we process this data only for the specific purposes concerned.

This may include in particular:

name and contact details,
professional qualifications,
knowledge and skills,
CV,
project experience,
availability,
desired type of engagement,
rate or compensation information,
language skills,
location and mobility,
other information required for the specific project or placement enquiry.

This processing serves in particular to assess a possible collaboration, to match you with suitable projects or enquiries, to initiate a project, and, where applicable, to arrange a placement or prepare a contract.

Depending on the circumstances, the legal basis is in particular Art. 6(1)(b) GDPR.

Where processing is necessary to safeguard the legitimate interests of VIA X Technology or a business partner, and no overriding interests of the data subject apply, processing may additionally be based on Art. 6(1)(f) GDPR.

Personal candidate or freelancer information is disclosed to prospective clients, project providers, or other parties involved in a specific placement only where a sufficient legal basis exists for this and the disclosure is necessary for the respective purpose.

Special categories of personal data are not to be disclosed unless strictly necessary for the respective matter.

9. Applications for Employment

If you apply to VIA X Technology for a permanent position, we process the application data you submit to carry out the application and selection process.

This may include in particular:

name and contact details,
address,
CV,
references,
qualifications,
professional background,
salary expectations,
availability,
information from interviews,
other application documents you submit.

The legal basis for processing as part of the decision on establishing an employment relationship is § 26(1) BDSG in conjunction with Art. 88 GDPR.

Where necessary, processing may additionally be based on Art. 6(1)(b) GDPR.

Special categories of personal data are processed only where a legal basis exists for this, or where you lawfully provide this data yourself as part of the application process.

If no employment relationship results, application data is generally deleted once the retention period required for possible legal claims has expired, unless longer storage is legally required, or you have expressly consented to longer storage, for example for a talent pool.

If an employment relationship results, the required data is transferred to HR administration and further processed in accordance with the applicable statutory requirements.

10. Recipients of Personal Data

Within VIA X Technology, only those individuals who need personal data for the purposes stated above are given access to it.

Beyond this, personal data may be disclosed, to the extent necessary, to service providers who support us in providing our IT, communication, hosting, scheduling, email or other business systems.

Where these service providers process personal data exclusively on our behalf, they are engaged as processors under Art. 28 GDPR, subject to the statutory requirements.

Disclosure to other recipients only takes place where:

this is necessary to perform a contract or pre-contractual measures,
a legal obligation exists,
a legitimate interest justifies the disclosure,
valid consent has been given,
or another legal basis exists.

11. International Data Transfers

Where personal data is transferred to recipients outside the European Union or the European Economic Area, this only takes place within the applicable statutory requirements.

This may include in particular:

an adequacy decision of the European Commission,
appropriate safeguards under Art. 46 GDPR, in particular Standard Contractual Clauses,
binding corporate rules,
or another legal basis permitted under the GDPR.

Where necessary, we additionally take into account the legal and factual circumstances of the respective recipient country for international transfers.

12. General Retention Period

Where this privacy policy does not state a more specific retention period, we store personal data only as long as necessary for the respective processing purpose.

Beyond this, personal data may be stored where we are obliged to do so under statutory retention or record-keeping obligations, or where storage is necessary to assert, exercise or defend legal claims.

Once the respective purpose no longer applies and the applicable retention periods have expired, the data is deleted or anonymised.

13. Data Security

We take appropriate technical and organisational measures to protect personal data against loss, manipulation, unauthorised access and other unlawful processing.

Our security measures are continuously reviewed and adapted in line with technical developments and the respective need for protection.

Our website is transmitted in encrypted form via TLS/HTTPS.

14. Your Rights

Subject to the statutory requirements, you have in particular the following rights:

Right of access under Art. 15 GDPR
You can request confirmation of whether, and which, personal data we process about you.

Right to rectification under Art. 16 GDPR
You can request the correction of inaccurate or the completion of incomplete personal data.

Right to erasure under Art. 17 GDPR
Subject to the statutory requirements, you can request the deletion of your personal data.

Right to restriction of processing under Art. 18 GDPR
Subject to the statutory requirements, you can request that the processing of your personal data be restricted.

Right to data portability under Art. 20 GDPR
Where the statutory requirements are met, you can receive personal data you have provided to us in a structured, commonly used and machine-readable format, or request that it be transmitted to another controller.

Right to object under Art. 21 GDPR
Where we process personal data based on Art. 6(1)(e) or (f) GDPR, you can object to this processing at any time on grounds relating to your particular situation.

Where personal data is processed for direct marketing, you can object to this processing at any time without giving reasons.

Withdrawal of consent
You can withdraw any consent given at any time with effect for the future. This does not affect the lawfulness of processing carried out based on the consent until its withdrawal.

15. Right to Lodge a Complaint with a Supervisory Authority

Under Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes the GDPR.

The supervisory authority responsible for non-public-sector companies based in Bavaria is in particular:

Bayerisches Landesamt für Datenschutzaufsicht (Bavarian State Office for Data Protection Supervision)
Promenade 18
91522 Ansbach
Germany
Phone: +49 (0)981 180093-0
Email: poststelle@lda.bayern.de
Website: www.lda.bayern.de
Complaints: BayLDA online complaint form (German-language)

You may also contact another supervisory authority with jurisdiction under applicable law.

16. Automated Decision-Making

A decision based solely on automated processing within the meaning of Art. 22 GDPR, which produces legal effects concerning you or similarly significantly affects you, does not take place as part of the website use described in this privacy policy, unless we expressly inform you otherwise in an individual case.

17. External Links

Our website may contain links to websites or services of other providers.

Where such external content is merely linked and not already loaded on our website, the mere display of the link does not, in principle, result in any data being transmitted to the respective external provider.

Only once you follow the link yourself does the respective provider’s privacy policy apply to any subsequent processing.

18. Changes to This Privacy Policy

We may update this privacy policy if our website, the services we use, legal requirements, or our internal processing procedures change.

The version published on this website at any given time is the authoritative one.

Last updated: October 2026